Decentralizing cybersecurity: Public audits benefit web3 industry | Opinion

by

As a seasoned crypto investor with over eight years of auditing experience at Deloitte under my belt, I wholeheartedly agree that decentralized security audits are the future of web3. Having worked for state agencies and served as an audit counselor, I’ve seen firsthand the importance of robust security measures.

Security audits are vital—but their results usually go unchallenged, while a single review can’t always spot all vulnerabilities. Public audits, pushing white hat hackers to double-check the audit’s results through DeFi incentives, could boost the security of the entire web3—as they would make bug bounties affordable to even small-scale projects.

Why usual audits aren’t always enough 

Based on the Q3 Security Report from Hacken, it’s startling to note that the web3 sector experienced a massive loss of approximately $1.8 billion in 2024. A significant portion, around 40%, resulted from issues that could have been prevented, such as smart contract vulnerabilities and reentrancy attacks. What’s even more concerning is that 90% of the hacked projects had not undergone any security audit, indicating a crucial lack of focus on security measures.

Instead of relying solely on traditional security audits for safety assurance during a project’s stages, it’s crucial to recognize their limitations. These audits often provide comprehensive, professional evaluations at key project milestones; however, because they are centralized, there’s typically no room for contesting the results unless additional resources are invested in another audit—a step that is seldom taken. It’s unrealistic to expect a single review to catch every potential issue, as even meticulous auditors can make mistakes due to human fallibility.

Addressing this issue hinges on the distributed philosophy of web3. By inviting more ethical hackers into crypto initiatives for regular, community-led audits, we can establish a secure, ongoing, and decentralized review system.

Decentralized security audits: Principles & perks 

The number one issue in designing decentralized audits is giving strong incentives to independent auditors while ensuring they don’t come at extra costs for the projects. Let me chart one possible way to strike this balance through DeFi tools. 

Picture this scenario: Whenever a new client asks for an audit, the security platform initiates a special smart contract-driven incentive fund. The company contributes a portion of the audit fee into this fund, while token holders boost it further by locking up the platform’s tokens. Once the platform has finished its own internal audit, outside security experts jump in to examine the client’s code. When the entire community has verified the client’s code, rewards are distributed from the pool among independent auditors and stakers.

Here’s one way to rephrase the given text: In Hacken, DualDefense Flash Pools operate by providing every client who pays for a private audit with an extra public audit. This setup establishes a two-tier security approach. Furthermore, the principles of Decentralized Finance (DeFi) are upheld as community engagement is encouraged through offering staking rewards.

Adopting this method brings extensive advantages: the community obtains a high-yield APY tool for real returns, auditors can collaborate on testing each other’s findings, and ethical hackers receive compensation for uncovering bugs—even in pristine code. For cryptocurrency initiatives, it signifies enhanced confidence in their code’s security. Across the entire web3 sector, it presents a practical strategy to bolster security and combat cyber threats.

Decentralized audits make it easier for web3 projects, including new ones, to ensure their security. Many cryptocurrency startups have promising Minimum Viable Products (MVPs), but they may not have enough resources for traditional bug bounties which can be expensive. Our proposed model addresses this issue by using a community-funded reward pool that provides a fixed amount of funds, making security costs predictable and affordable from the beginning.

Performing these audits directly involves a tangible risk for auditing firms, as it links their reputation to the platform’s work. Yet, this approach provides an additional motivation for the company to handle each audit meticulously due to the increased publicity of its results. In the long run, this could positively impact the entire industry. Auditors specializing in smart contracts should not shy away after completing an audit; instead, they should take ownership and demonstrate courage.

Ultimately, public audit pools offer a unique aspect to DeFi that wasn’t present before—rewards tied to real-world currency. This structure ensures that the returns for users aren’t fueled by inflationary token emissions, which can lead to exponential growth that isn’t sustainable and ultimately causes value depreciation. By tying user rewards to actual market activity, these pools move DeFi a step closer to more enduring financial models.

By blending conventional audits with open, community-led audits, we can establish a robust security system that caters to projects of all sizes. Community audits, fueled by DeFi incentives, represent a significant shift towards a security culture in web3 that is transparent, strong, and proactive.

Dyma Budorin

Dyma Budorin serves as both co-founder and CEO of Hacken, a top blockchain security auditing firm. Additionally, he plays a significant role as co-chair in the EEA DRAMA (a group dedicated to managing and accounting for risks within DeFi), and has contributed to creating standards within the crypto industry. With more than eight years of experience in auditing, Dyma has held positions at Deloitte, Ukrspetsexport, and Ukrinmash (Ukrainian state agencies). As a passionate advocate for cryptocurrencies and cybersecurity, his insights have been showcased by renowned media outlets like BBC, Wired, Cointelegraph, Coindesk, among others. In addition, he holds the position of Vice President within the Blockchain Association of Ukraine.

Read More

2024-11-27 15:12